Security
Security built into every layer.
- Tenant isolation
- Enforced at the data layer
- Encryption
- TLS 1.3 · AES-256 at rest
- Backups
- Daily, 30-day retention
See the controls in action
The same mechanisms described below — capability-based RBAC, maker-checker dual-control, a full audit log, and device trust — as they appear inside the Staff Admin & Security app. Switch tabs to explore each.
Explore Staff, Admin & Security →- Loan officer22
- Branch manager9
- Finance6
- Compliance / MLRO5
- Auditor (read-only)4
Five controls, shown
The controls behind the platform, at a glance — how institutions are isolated, how access is governed, how sensitive actions are dual-controlled, how devices are trusted, and how every action is recorded.
Data isolation
Each institution operates within its own data boundary.
Isolated tenant boundaries — one institution cannot access another's data.
Access control
What a person can do follows their role, capability and branch scope.
Maker-checker
Sensitive actions need a second authorized person to approve.
- MakerCreates / submits action
- CheckerReviews / approves
- Audit logRecords the decision
Trusted devices
A device must be enrolled and approved before it can authenticate.
| Device | User | Status | Last active |
|---|---|---|---|
| Android A24 | Field officer | Trusted | Today |
| iPhone 15 | Branch manager | Trusted | Today |
| Windows PC | Finance | Trusted | Yesterday |
| Unknown device | — | Blocked | — |
Audit trail
Sensitive actions are recorded — actor, action and time.
- 10:42:18Neema K.Loan #4021Approved
- 10:38:44Joseph K.Customer #842Updated
- 10:21:06Sarah P.User roleChanged
- 09:54:31Daniel M.CollateralUpdated
- 09:42:17Neema K.Payment #8842Posted
Know who did what, when, and where the action occurred.
These are the product-level controls. The precise technical and organizational measures — encryption, hosting, backups, incident response and more — are set out in the formal Security & Data Protection Statement.
Read the formal statement →Tenant data isolation
Each institution operates within its own logically isolated data environment. Tenant boundaries are enforced at the data layer, so one institution cannot access another's borrowers, loans, or reports. This is the platform-specific risk MFI and SACCO IT leads care about most — the precise technical detail is set out in the formal Security & Data Protection Statement.
Access control and governance
Access is governed by fail-closed, capability-based RBAC: a role without a capability never renders the feature at all — not a disabled button, no UI surface at all. Sensitive actions require dual-control (maker-checker) approval by a second authorized person, and staff and field-agent access is scoped to assigned branches.
Data protection
KYC documents, signed agreements, and collateral evidence are stored in a unified per-tenant document store under the same role- and branch-scoped access controls as the rest of the platform. Data is encrypted in transit with TLS 1.3 and at rest with AES-256, hosted in a secure, access-controlled hosting environment with data residency in the East Africa region. Backups run daily with 30-day retention.
Compliance alignment
Sensitive actions are captured in a full audit log; AML screening results and STR records are handled with restricted, tipping-off-aware access. The platform's reporting is designed for Bank of Tanzania alignment — see the formal Security & Data Protection Statement for the due-diligence-grade detail.
Certifications
We do not currently hold third-party security certifications (e.g. ISO 27001, SOC 2). Rather than imply otherwise, we say so plainly — ask us directly about our controls and we'll walk you through them.
Ask us about our controls →Report a vulnerability
We welcome good-faith security research. See our Vulnerability Disclosure Policy for scope, safe harbor, and how to report an issue responsibly.
Vulnerability Disclosure Policy →Frequently asked questions
Is my institution's data isolated from other tenants?
Yes — each institution's data is logically isolated at the data layer; no tenant can access another's data. The formal Security & Data Protection Statement has the precise technical detail.
How do you control who at my institution can see borrower data?
Fail-closed, capability- and branch-scoped RBAC: staff only see what their role and branch assignment permit.
Does Ustawi hold security certifications?
Not currently — we state this plainly rather than imply certification. Contact us to discuss our controls directly.
How do I report a security vulnerability?
Through our Vulnerability Disclosure Policy at /legal/vulnerability-disclosure-policy.
Talk to us about your security requirements.
We'll walk your IT and compliance leads through tenant isolation, access control, and our controls in detail.